arXiv:2608. 04192v1 Announce Type: cross Abstract: Closed source agent skills may encode proprietary instructions, scripts, constants, and data.
The paper "SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agents" investigates how agent skills—task‑specific instructions, scripts, and resources—can be exploited to create a trusted instruction channel that enables token amplification attacks. It introduces a two‑phase framework, SkillBloat, which first screens a library of attack‑type conditions across multiple amplification mechanisms and then refines the strongest candidate through LLM‑guided full‑document skill rewriting. Evaluated on a real‑world skill benchmark, SkillBloat achieves an average best amplification of 5.4184×–10.1455× across multiple coding‑agent target configurations, and an ablation study shows that the second‑stage refinement consistently improves performance over the initial screening alone.
The paper introduces PERSIST, a method that allows attackers to inject malicious actions into large language model agents by linking attacker-chosen actions to useful functions while minimizing source inspection and suspicion. PERSIST builds helper functions from simulated executions and embeds them in separate modules, enabling the agent to perform both user tasks and attacker objectives. Experiments on SkillsBench and Skill-Inject demonstrate that frozen skill packages transfer across multiple agent–model configurations, generalize to unseen tasks, and increase harmful-effect rates compared to baselines.
arXiv:2602. 06547v3 Announce Type: replace-cross Abstract: LLM-based coding agents increasingly rely on third-party extensions called skills, which bundle natural language instructions and helper scripts that execute with full user privileges.
arXiv:2610.17727v2 Announce Type: cross Abstract: Agent skills turn natural-language instructions into actions, creating a security challenge: legitimate automation and malicious behaviour can look d...
arXiv:2602. 14211v3 Announce Type: replace-cross Abstract: Agent skills extend LLM agents with task-specific instructions, executable scripts, and auxiliary resources, improving reusability but creating a new supply-chain attack surface.
arXiv:2602. 06547v4 Announce Type: replace-cross Abstract: LLM-based coding agents increasingly rely on third-party extensions called skills, which bundle natural language instructions and helper scripts that execute with full user privileges.
The paper titled "Pretext: Defeating Malicious Skill Detection Frameworks for AI Agents" demonstrates how an attacker can bypass current skill‑scanning defenses by crafting malicious skills that evade both static analysis and LLM‑based semantic checks. By moving malicious payloads into natural language and distributing instructions across files, the white‑box attacker named Pretext achieves high evasion rates—up to 97% against a frozen detector and 77% against a co‑adaptive one—across three open‑source models.
SkillPoison demonstrates that self‑improving large language model agents can be progressively poisoned through successful experiences without any single trajectory being malicious. The framework constructs successful experiences that reinforce a target behavior, then removes contextual constraints so the skill extractor generalizes to harmful behavior when misapplied. Experiments on three benchmarks show a 95.71% attack success rate while all injected experiences remain task‑correct and pass verification and lexical inspection.
arXiv:2609.39065v1 Announce Type: cross Abstract: LLM agents increasingly rely on installable skills, which are packages of instructions, code, and resources that equip them with task-specific capabi...
arXiv:2604. 01039v2 Announce Type: replace-cross Abstract: System Instructions in Large Language Models (LLMs) are commonly used to enforce safety policies, define agent behavior, and protect sensitive operational context in agentic AI applications.
Skills extend an agent's capabilities by injecting instructions and information into the context, and are widely used by agents such as OpenClaw and Claude Code. Prior work shows third-party marketpla...